A system administrator needs to implement 802.1x whereby when a user logs into the network, the authentication server communicates to the network switch and assigns the user to the proper VLAN. Which

RADIUS (Remote Authentication Dial-In User Service) is the protocol used in 802.1x deployments to authenticate users and dynamically assign them to VLANs via RADIUS attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID sent back to the authenticator (switch). RADIUS operates between the network access device (switch acting as authenticator) and the authentication server (RADIUS server acting as AS), making it the standard choice for 802.1x NAC implementations. No other listed protocol supports this authenticator-to-server communication model with VLAN assignment capability.

Kerberos is a ticket-based authentication protocol designed for user-to-service authentication in domain environments and does not support communication with network switches for dynamic VLAN assignment.

LDAP is a directory access protocol used to query and modify directory services such as Active Directory, and while it may be used as a backend user store, it does not provide the network access control messaging needed to assign VLANs via a switch.

MS-CHAP is a Microsoft challenge-handshake authentication protocol used for credential exchange (often encapsulated within RADIUS or PEAP), not a standalone protocol capable of communicating VLAN assignments to network switches.